Liferay DXP CVE-2025-62238

Exploitation requires (1) an authenticated session with at least low-privilege rights to edit an Account's 'Name' text field (PR:L - unauthenticated users cannot inject), and (2) a victim - typically another user or administrator - to subsequently view the Membership page within Account Settings where the stored payload renders (UI:A/UI:R). This is a stored XSS confined to the Membership page context in Liferay Portal 7.4.3.21-7.4.3.111 and Liferay DXP 2023.Q4.0-Q4.5, 2023.Q3.1-Q3.8, and 7.4 update 21-92. Limiting factors that reduce realistic risk: the attacker must already hold a valid low-privilege account, the payload only fires when a separate user opens the specific admin/membership view, and impact is scoped to the browser session (no direct system compromise, VA/SC/SI/SA:N).

This is a genuinely moderate, not critical, issue and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) scores 4.8 (Medium): network-reachable but requiring low-level authentication (PR:L) AND victim interaction (UI:A, an admin/user must view the malicious Account name), with only low confidentiality and integrity impact and no availability impact - typical of a stored XSS confined to a single application context. EPSS reinforces low urgency at 0.22% (12th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis. All signals align downward: authenticated prerequisite, required interaction, limited impact, low exploitation probability. The one thing to verify is the real-world blast radius - stored XSS in an account 'Name' field rendered on a Membership/administration page could execute in a higher-privileged user's browser (potential session/token theft or privileged actions), which is why the impact is non-zero rather than informational; however, the vendor scored scope/subsequent-system impact as none (SC/SI/SA:N), implying no cross-system escalation. Treat as a routine patch-cycle item, not an emergency.

A low-privileged authenticated user with permission to edit an Account's profile injects a crafted script payload into the Account 'Name' text field, which Liferay stores without proper encoding. When an administrator or other user later opens the Membership page under Account Settings, the stored script executes in their browser session, potentially stealing session data or performing actions in their context. No public proof-of-concept exploit has been identified, and exploitation depends on a privileged victim viewing the affected page.